Microsoft's AI-driven FORGE lab helped find 140 Windows CVEs in five months

Microsoft's verb for the 140 is "helped discover" ^[2]. The post does not separate agent findings from human work, rate the flaws by severity, or say whether any were exploited before a fix shipped ^[2]. On the public record, this is defender-side research on Windows and on open-source code [c1, c4].

September is the month that matters for patch planning. Take the 52 from the 140 and May through August leave 88 CVEs, or 22 a month [d1, d2]. September alone is about 37 percent of the five-month total, at roughly 2.4 times the earlier monthly pace [d3, d4]. One month cannot show whether that is a ramp or a backlog of findings that cleared review in the same cycle ^[3].

Microsoft's own account puts the limit at the review stage. Adding auditors can raise the number of candidate bugs without raising validated findings or shipped fixes, the post says, and when reports arrive faster than the Microsoft Security Response Center can resolve them, the immediate result is a growing queue ^[7]. "Discovery creates security value only when validation and remediation can keep pace," Microsoft wrote ^[9].

Microsoft's answer is tooling between discovery and review. Project-specific provers, including proof-of-concept generators, harness builders and trigger-input finders, run inside each project's build and test environment. They find crashing inputs and confirm that execution paths are reachable ^[11]. Microsoft says the unit to optimize is a reproducible finding with enough evidence for the next stage to act ^[12]. "The scarce resource is not always model intelligence. It can be a working build and deployment, a reproducible trigger, or even an engineer's time," the post said ^[10].